Skip to content

POC of ransomware in powershell using AES 256bit encryption and decryptor script.

Notifications You must be signed in to change notification settings

beigew0rm/PoshCryptor

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

2 Commits
 
 
 
 
 
 
 
 
 
 

Repository files navigation

Ransomware in Powershell!

SYNOPSIS This script encrypts all files within selected folders, posts the encryption key to a Discord webhook, and starts a non closable window with a notice to the user.

WARNING WARNING WARNING WARNING WARNING WARNING WARNING WARNING

THIS IS EFFECTIVELY RANSOMWARE - I CANNOT TAKE RESPONSIBILITY FOR LOST FILES!

DO NOT USE THIS ON ANY CRITICAL SYSTEMS OR SYSTEMS WITHOUT PERMISSION

THIS IS A PROOF OF CONCEPT TO WRITE RANSOMWARE IN POWERSHELL AND IS FOR EDUCATIONAL PURPOSES

WARNING WARNING WARNING WARNING WARNING WARNING WARNING WARNING

USAGE

  1. Enter your webhook below. (if not pre-defined in a stager file or duckyscript etc)
  2. Run the script on target system.
  3. Check Discord for the Decryption Key.
  4. Use the decryptor to decrypt the files.

CREDIT

Credit and kudos to InfosecREDD for the idea of writing ransomware in Powershell

this is my interpretation of his non publicly available script used in this Talking Sasquatch video.

https://youtu.be/IwfoHN2dWeE

SCREENSHOTS

note

Screenshot_1

save

About

POC of ransomware in powershell using AES 256bit encryption and decryptor script.

Resources

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published